SB2016121317 - Scripting Engine Memory Corruption Vulnerability

Description

This security bulletin contains information about 1 security vulnerability.

1) Heap-based buffer overflow (CVE-ID: CVE-2016-7202)

A remote attacker can execute arbitrary code on the target system.

The vulnerability exists due to incorrect handling of JavaScript Array.reverse method in chakra.dll. A remote attacker can create a specially crafted web page or Microsoft Office file with embedded malicious ActiveX component, trick the victim to open it in browser, cause heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable system with privileges of the current user.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7202